A vulnerability is a weakness in software, hardware, configuration or processes that an attacker can abuse to compromise the confidentiality, integrity or availability of a system.
How vulnerabilities arise
Most vulnerabilities are programming mistakes: missing input validation, memory-safety bugs, broken access checks or weak cryptography. Others come from insecure defaults, forgotten test accounts, exposed admin panels or unpatched components inside third-party libraries. The CWE list catalogues such weakness types, and the OWASP Top 10 ranks the most common ones in web applications.
Publicly known vulnerabilities receive a CVE identifier (for example CVE-2021-44228). The CVE programme, run by MITRE since 1999, is fed by vendors and researchers, and the US National Vulnerability Database adds details. Today tens of thousands of CVEs are published every year.
Why vulnerabilities matter for security
A vulnerability becomes a real risk when there is an exploit and a reachable target. Exploiting known flaws is one of the top ways attackers break into companies, alongside phishing and stolen credentials. Severity is usually expressed with the CVSS score, but the most important question is whether a flaw is already exploited in the wild – a medium-rated bug under active attack is more urgent than a critical one nobody uses.
Vulnerability management in practice
- Keep an asset and software inventory, including open-source dependencies (SBOM).
- Scan regularly and prioritize by exploitation status (CISA KEV, EPSS), exposure and business impact.
- Patch within defined deadlines; if patching is impossible, apply workarounds or isolate the system.
- Publish a vulnerability disclosure policy or a bug bounty so that researchers can report issues safely.
